refactor(server): split tool_risk into a package

[RaghavChamadiya]

What

The get_risk MCP tool had grown to ~1034 lines, covering single-target risk scoring, post-assessment result enrichment, and PR-mode directive assembly (breaking-change, cross-repo, conformance, governance) all in one module alongside the tool entrypoint.

This splits it into a tool_risk/ package:

• assessment.py single-target risk scoring helpers
• enrichment.py cross-repo / health / dep-summary result enrichment
• directives.py PR-mode directive assembly
• get_risk.py the @mcp.tool() orchestrator

Why

The three phases (score, enrich, build directive) are now isolated and independently testable rather than interleaved in one long module.

Safety

Pure structural move: every symbol relocates verbatim, lazy imports stay function-local, and absolute sibling imports are preserved. The @mcp.tool() decorator on get_risk stays in get_risk.py and __init__.py imports it, so import-time registration still fires exactly once. __init__.py re-exports get_risk plus the helpers routers/git.py and the tests import, so the public path repowise.server.mcp_server.tool_risk is unchanged. No importer or test needed an edit.

Verified: the MCP tool registers once and the risk/budget/conformance/blast-radius suites (41 tests) pass.

[repowise-bot]

✅ Health: 7.6 (unchanged)

📋 At a glance
10 new findings introduced.

🚨 Change risk: high _{(riskier than 88% of this repo's commits · raw 9.7/10)}
This change's risk is driven by:

• more lines added than baseline
• more scattered than baseline

---

📊 Full report · ⭐ Star Repowise · 📥 Install bot · Last updated 2026-07-08 09:53 UTC
_{Silence on a single PR with [skip repowise] in the title · Per-repo toggle on repowise.dev/settings?tab=bot}